Resources

Use maintained cryptographic and identity libraries, protocol test clients, certificate inspection, secret managers, policy engines, audit logs, and reproducible negative tests. Never place real secrets in learner artifacts.

Required evidence

Submit diagrams, versioned configuration, runnable positive and negative tests, audit events, one rejected design, remediation record, and residual-risk owner. Scanner output without mechanism-level triage does not pass.

Oral defense

Name the attacker and asset, explain the exact control property, demonstrate a denied misuse case, and execute revocation or safe recovery.

Source backbone

Use NIST SP 800-63, OWASP ASVS, relevant RFCs, and Building Secure and Reliable Systems.